Not rated
CVE-2020-1476 An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow…
Description
An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files. An attacker who successfully exploited this vulnerability could gain access to restricted files. To exploit this vulnerability, an attacker would need to send a specially crafted request to an affected server. The update addresses the vulnerability by changing how ASP.NET and .NET handle requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft .NET Framework 4.8 4.8 | 4.8.0 → latest | No fix stated |
| Microsoft .NET Framework 3.5 AND 4.8 4.8 | 4.8.0 → latest | No fix stated |
| Microsoft .NET Framework 2.0 Service Pack 2 2.0 | 2.0.0 → latest | No fix stated |
| Microsoft .NET Framework 4.5.2 4.0 | 4.0.0.0 → latest | No fix stated |
| Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 4.0 | 4.0.0.0 → latest | No fix stated |
| Microsoft .NET Framework 3.5 AND 4.7.2 4.7 | 4.7.0 → latest | No fix stated |
| Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 3.0 | 3.0.0.0 → latest | No fix stated |
| Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2 3.5 | 3.5.0 → latest | No fix stated |
| Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2 3.0 | 3.0 → latest | No fix stated |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft .NET Framework 4.6 4.0 | 4.0.0.0 → latest | No fix stated |
| Microsoft .NET Framework 3.5 3.5 | 3.5.0 → latest | No fix stated |
| Microsoft .NET Framework 3.5.1 3.5 | 3.5.0 → latest | No fix stated |
References
- portal.msrc.microsoft.com portal.msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft .NET Framework 4.8
The 78 CVEs of Microsoft .NET Framework 4.8 →
CVE-2026-97801
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering…
7.5
High
CVE-2026-102869
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized…
8.8
High
CVE-2026-58280
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network
7.5
High
CVE-2026-97788
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose…
7.5
High